-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:187
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : php
 Date    : September 21, 2007
 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 Numerous vulnerabilities were discovered in the PHP scripting language
 that are corrected with this update.
 
 An integer overflow in the substr_compare() function allows
 context-dependent attackers to read sensitive memory via a large
 value in the length argument.  This only affects PHP5 (CVE-2007-1375).
 
 A stack-based buffer overflow in the zip:// URI wrapper in PECL
 ZIP 1.8.3 and earlier allowes remote attackers to execute arbitrary
 code via a long zip:// URL.  This only affects Corporate Server 4.0
 (CVE-2007-1399).
 
 A CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter
 could allow an attacker to inject arbitrary email headers via a
 special email address.  This only affects Mandriva Linux 2007.1
 (CVE-2007-1900).
 
 The mcrypt_create_iv() function calls php_rand_r() with an
 uninitialized seed variable, thus always generating the same
 initialization vector, which may allow an attacker to decrypt
 certain data more easily because of the guessable encryption keys
 (CVE-2007-2727).
 
 The soap extension calls php_rand_r() with an uninitialized seec
 variable, which has unknown impact and attack vectors; an issue
 similar to that affecting mcrypt_create_iv().  This only affects PHP5
 (CVE-2007-2728).
 
 The substr_count() function allows attackers to obtain sensitive
 information via unspecified vectors.  This only affects PHP5
 (CVE-2007-2748).
 
 An infinite loop was found in the gd extension that could be used to
 cause a denial of service if a script were forced to process certain
 PNG images from untrusted sources (CVE-2007-2756).
 
 An integer overflow flaw was found in the chunk_split() function that
 ould possibly execute arbitrary code as the apache user if a remote
 attacker was able to pass arbitrary data to the third argument of
 chunk_split() (CVE-2007-2872).
 
 A flaw in the PHP session cookie handling could allow an attacker to
 create a cross-site cookie insertion attack if a victim followed an
 untrusted carefully-crafted URL (CVE-2007-3799).
 
 Various integer overflow flaws were discovered in the PHP gd extension
 that could allow a remote attacker to execute arbitrary code as the
 apache user (CVE-2007-3996).
 
 A flaw in the wordwrap() frunction could result in a denial of ervice
 if a remote attacker was able to pass arbitrary data to the function
 (CVE-2007-3998).
 
 A flaw in the money_format() function could result in an information
 leak or denial of service if a remote attacker was able to pass
 arbitrary data to this function; this situation would be unlikely
 however (CVE-2007-4658).
 
 A bug in the PHP session cookie handling could allow an attacker to
 stop a victim from viewing a vulnerable website if the victim first
 visited a malicious website under the control of the attacker who
 was able to use that page to set a cookie for the vulnerable website
 (CVE-2007-4670).
 
 Updated packages have been patched to prevent these issues.
 In addition, PECL ZIP version 1.8.10 is being provided for Corporate
 Server 4.0.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1375
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1399
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2727
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2728
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2748
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3799
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3998
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4658
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4670
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 57a68f47fd8c691db93b9eadbbf19b40  2007.0/i586/libphp5_common5-5.1.6-1.9mdv2007.0.i586.rpm
 f82d39f70da087f4d7f9470f81211276  2007.0/i586/php-cgi-5.1.6-1.9mdv2007.0.i586.rpm
 a22e66bf85ab53ff1782ce331ffa60a6  2007.0/i586/php-cli-5.1.6-1.9mdv2007.0.i586.rpm
 c3cd07dba2182b4f583794a3b240e84e  2007.0/i586/php-devel-5.1.6-1.9mdv2007.0.i586.rpm
 265ef0003e043ad3013022b1e566fd89  2007.0/i586/php-fcgi-5.1.6-1.9mdv2007.0.i586.rpm
 598e110d6abcc345a0b6ee1676214ee2  2007.0/i586/php-gd-5.1.6-1.3mdv2007.0.i586.rpm
 0f9a486f5ccadd55c81aa61705ae5d81  2007.0/i586/php-mcrypt-5.1.6-1.1mdv2007.0.i586.rpm
 6d7d80d3cdeae2e4ca286b67be659cef  2007.0/i586/php-soap-5.1.6-1.2mdv2007.0.i586.rpm 
 06fef845a7f0eb15fbda8e01d2449759  2007.0/SRPMS/php-5.1.6-1.9mdv2007.0.src.rpm
 1c4c5379d367dd0ba8c002d2a60eb8b1  2007.0/SRPMS/php-gd-5.1.6-1.3mdv2007.0.src.rpm
 4b4382448f9be55ea66f8b910a12a97c  2007.0/SRPMS/php-mcrypt-5.1.6-1.1mdv2007.0.src.rpm
 c9e9b415eac3b864ffcece762c6aa6bb  2007.0/SRPMS/php-soap-5.1.6-1.2mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 8ddfb570e663d8b61cbfaf5bc8585d54  2007.0/x86_64/lib64php5_common5-5.1.6-1.9mdv2007.0.x86_64.rpm
 d05d20ad5c5ddd84649aaed661b83c7a  2007.0/x86_64/php-cgi-5.1.6-1.9mdv2007.0.x86_64.rpm
 9ba45cce68ffa043cf1fb23fe765e104  2007.0/x86_64/php-cli-5.1.6-1.9mdv2007.0.x86_64.rpm
 26ead0e8cd3bab9ba64cc39f596d6533  2007.0/x86_64/php-devel-5.1.6-1.9mdv2007.0.x86_64.rpm
 65673d78e3e1af683d64e30ba832be63  2007.0/x86_64/php-fcgi-5.1.6-1.9mdv2007.0.x86_64.rpm
 0d478806da998759a96cdbf8694c0324  2007.0/x86_64/php-gd-5.1.6-1.3mdv2007.0.x86_64.rpm
 99ec9336533a6ff74b93841497a73fe1  2007.0/x86_64/php-mcrypt-5.1.6-1.1mdv2007.0.x86_64.rpm
 1b5bdc02b561134835c729fb404b0931  2007.0/x86_64/php-soap-5.1.6-1.2mdv2007.0.x86_64.rpm 
 06fef845a7f0eb15fbda8e01d2449759  2007.0/SRPMS/php-5.1.6-1.9mdv2007.0.src.rpm
 1c4c5379d367dd0ba8c002d2a60eb8b1  2007.0/SRPMS/php-gd-5.1.6-1.3mdv2007.0.src.rpm
 4b4382448f9be55ea66f8b910a12a97c  2007.0/SRPMS/php-mcrypt-5.1.6-1.1mdv2007.0.src.rpm
 c9e9b415eac3b864ffcece762c6aa6bb  2007.0/SRPMS/php-soap-5.1.6-1.2mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 cfb5ebca225920865fd41b8d7379ec04  2007.1/i586/libphp5_common5-5.2.1-4.3mdv2007.1.i586.rpm
 fd99e8fd1eba60464844111ba0bf658f  2007.1/i586/php-cgi-5.2.1-4.3mdv2007.1.i586.rpm
 d2d5ef2a6eb326c85e5e4e66d5488032  2007.1/i586/php-cli-5.2.1-4.3mdv2007.1.i586.rpm
 f8ff08caf4bf9d4b06c84dabf426ad4f  2007.1/i586/php-devel-5.2.1-4.3mdv2007.1.i586.rpm
 0e362fc96f32b9046df73d01938f4a4f  2007.1/i586/php-fcgi-5.2.1-4.3mdv2007.1.i586.rpm
 3796283e1a18abd35c66e9fdb7cecf84  2007.1/i586/php-gd-5.2.1-1.2mdv2007.1.i586.rpm
 8303fdaff4f40f7025e84b9571db7557  2007.1/i586/php-mcrypt-5.2.1-1.1mdv2007.1.i586.rpm
 765b7cff3e34bf6be0d31d5e11c6d21f  2007.1/i586/php-openssl-5.2.1-4.3mdv2007.1.i586.rpm
 8ed091e407210049489fb70ba4f18e3f  2007.1/i586/php-soap-5.2.1-1.2mdv2007.1.i586.rpm
 649f2efadad45640ca14f5ab644de67f  2007.1/i586/php-zlib-5.2.1-4.3mdv2007.1.i586.rpm 
 8779e5a26aecb35eaf93a5c54f35a798  2007.1/SRPMS/php-5.2.1-4.3mdv2007.1.src.rpm
 d16710089832ae31873c0db7e6df87fd  2007.1/SRPMS/php-gd-5.2.1-1.2mdv2007.1.src.rpm
 ec8b2d536f13c35dd2c2f1cca92c5694  2007.1/SRPMS/php-mcrypt-5.2.1-1.1mdv2007.1.src.rpm
 90f9821184ef2fc8cca2a35e54080f44  2007.1/SRPMS/php-soap-5.2.1-1.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 4af5b6e98feeeb88b8993768c15497ce  2007.1/x86_64/lib64php5_common5-5.2.1-4.3mdv2007.1.x86_64.rpm
 f5e5fbb413e349ff9ae9e8e82a59dd92  2007.1/x86_64/php-cgi-5.2.1-4.3mdv2007.1.x86_64.rpm
 c93c070b38a3c2602dbfea38e648fea1  2007.1/x86_64/php-cli-5.2.1-4.3mdv2007.1.x86_64.rpm
 5d7fa073092e6599eddaaffab5b4df4f  2007.1/x86_64/php-devel-5.2.1-4.3mdv2007.1.x86_64.rpm
 0d593dad6f79e0331d1a9c7544d6fe42  2007.1/x86_64/php-fcgi-5.2.1-4.3mdv2007.1.x86_64.rpm
 8652914b9aa256724004e12621111ce3  2007.1/x86_64/php-gd-5.2.1-1.2mdv2007.1.x86_64.rpm
 cc2993f0faf2d76eb317162162237049  2007.1/x86_64/php-mcrypt-5.2.1-1.1mdv2007.1.x86_64.rpm
 2becb2e136e605d4b6fcbb80b8b96fdc  2007.1/x86_64/php-openssl-5.2.1-4.3mdv2007.1.x86_64.rpm
 241a453a1007cc84f0f789b2a11bf96f  2007.1/x86_64/php-soap-5.2.1-1.2mdv2007.1.x86_64.rpm
 58a30a4284944ed364d488338c6d4605  2007.1/x86_64/php-zlib-5.2.1-4.3mdv2007.1.x86_64.rpm 
 8779e5a26aecb35eaf93a5c54f35a798  2007.1/SRPMS/php-5.2.1-4.3mdv2007.1.src.rpm
 d16710089832ae31873c0db7e6df87fd  2007.1/SRPMS/php-gd-5.2.1-1.2mdv2007.1.src.rpm
 ec8b2d536f13c35dd2c2f1cca92c5694  2007.1/SRPMS/php-mcrypt-5.2.1-1.1mdv2007.1.src.rpm
 90f9821184ef2fc8cca2a35e54080f44  2007.1/SRPMS/php-soap-5.2.1-1.2mdv2007.1.src.rpm

 Corporate 3.0:
 247e24717edaad099d4dfac36d06da11  corporate/3.0/i586/libphp_common432-4.3.4-4.27.C30mdk.i586.rpm
 a2fe1080b8981493b83f6bb6c08a6f83  corporate/3.0/i586/php-cgi-4.3.4-4.27.C30mdk.i586.rpm
 0468aa254c2495b128f4ea776b7100f7  corporate/3.0/i586/php-cli-4.3.4-4.27.C30mdk.i586.rpm
 230476bcb71774884ec17ecbef336e5c  corporate/3.0/i586/php-gd-4.3.4-1.7.C30mdk.i586.rpm
 3cac8eecfdee304b0889fbe99958a6ca  corporate/3.0/i586/php432-devel-4.3.4-4.27.C30mdk.i586.rpm 
 74c8bcac18b502174d270a0e2529d8e8  corporate/3.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
 7db08e02ff0b4d59c58bbef5ff25a89b  corporate/3.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 54b38db5000d71f5f4cfe0d55ea8839d  corporate/3.0/x86_64/lib64php_common432-4.3.4-4.27.C30mdk.x86_64.rpm
 e06d422dedbd7ff39eb86c8afdf23f8c  corporate/3.0/x86_64/php-cgi-4.3.4-4.27.C30mdk.x86_64.rpm
 66bea84020ec6231dbc345215b6398d4  corporate/3.0/x86_64/php-cli-4.3.4-4.27.C30mdk.x86_64.rpm
 6e47af7339e7c939133d3bbab0b54c60  corporate/3.0/x86_64/php-gd-4.3.4-1.7.C30mdk.x86_64.rpm
 9aa27728797f8a8b7fe6932237779dc1  corporate/3.0/x86_64/php432-devel-4.3.4-4.27.C30mdk.x86_64.rpm 
 74c8bcac18b502174d270a0e2529d8e8  corporate/3.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
 7db08e02ff0b4d59c58bbef5ff25a89b  corporate/3.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm

 Corporate 4.0:
 6660cfe8b3e883412a9d138cb4776a17  corporate/4.0/i586/libphp4_common4-4.4.4-1.7.20060mlcs4.i586.rpm
 0a43b956bf221f3dc6b534aed4c2c332  corporate/4.0/i586/libphp5_common5-5.1.6-1.8.20060mlcs4.i586.rpm
 d01223da70e8e3c6c17b0bd065cf4747  corporate/4.0/i586/php-cgi-5.1.6-1.8.20060mlcs4.i586.rpm
 9cdf4d6ba4446811b0118126b31dd80b  corporate/4.0/i586/php-cli-5.1.6-1.8.20060mlcs4.i586.rpm
 6f486a6a19edef73ac2bc6aba2cf342a  corporate/4.0/i586/php-devel-5.1.6-1.8.20060mlcs4.i586.rpm
 a126823de602fb9aecae42f052ab2827  corporate/4.0/i586/php-fcgi-5.1.6-1.8.20060mlcs4.i586.rpm
 9c198b7e8a34c3e4d03f18174b2b1a84  corporate/4.0/i586/php-gd-5.1.6-1.3.20060mlcs4.i586.rpm
 b58d0518a5a44bdb26006df7b3d0b9f4  corporate/4.0/i586/php-mcrypt-5.1.6-1.1.20060mlcs4.i586.rpm
 c306da649d383d2ef0d4e568e8f77bd2  corporate/4.0/i586/php-soap-5.1.6-1.2.20060mlcs4.i586.rpm
 6fbcf94c677317eaa73f2972afbece1c  corporate/4.0/i586/php-zip-1.8.10-0.1.20060mlcs4.i586.rpm
 473813677bb2f261182b53f6175908b8  corporate/4.0/i586/php4-cgi-4.4.4-1.7.20060mlcs4.i586.rpm
 5c53c5fd3860246341522a47712b7d18  corporate/4.0/i586/php4-cli-4.4.4-1.7.20060mlcs4.i586.rpm
 079851b5a916b27cb16aa4bde9bcd86e  corporate/4.0/i586/php4-devel-4.4.4-1.7.20060mlcs4.i586.rpm
 cf0a080ecd0acb5e01f7e2e41ed3c76d  corporate/4.0/i586/php4-gd-4.4.4-1.2.20060mlcs4.i586.rpm
 c2333bbae7d3a20b90a2e174f2caf5da  corporate/4.0/i586/php4-mcrypt-4.4.4-1.1.20060mlcs4.i586.rpm 
 b406cd54519867c9611c6c6700827457  corporate/4.0/SRPMS/php-5.1.6-1.8.20060mlcs4.src.rpm
 491027bf3182f1f56e93e4d3a053d9e0  corporate/4.0/SRPMS/php-gd-5.1.6-1.3.20060mlcs4.src.rpm
 dd89eef4f40af9dff068c28bd56b4d5b  corporate/4.0/SRPMS/php-mcrypt-5.1.6-1.1.20060mlcs4.src.rpm
 d7107b5be0e7768abad9c15cc8584ded  corporate/4.0/SRPMS/php-soap-5.1.6-1.2.20060mlcs4.src.rpm
 f39e559d753bc59816d4106cd095d0db  corporate/4.0/SRPMS/php-zip-1.8.10-0.1.20060mlcs4.src.rpm
 1f1fd034cfd3d3f911315a34326d553e  corporate/4.0/SRPMS/php4-4.4.4-1.7.20060mlcs4.src.rpm
 00447503df74be2f96f4ec4f93de6694  corporate/4.0/SRPMS/php4-gd-4.4.4-1.2.20060mlcs4.src.rpm
 c005bcfb3c95e618ba5a4c928d5b75c7  corporate/4.0/SRPMS/php4-mcrypt-4.4.4-1.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 d04a06f2a1d4c8d36b1ce3de6448577b  corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.7.20060mlcs4.x86_64.rpm
 b22d1122c842de135ddf34d331641da8  corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.8.20060mlcs4.x86_64.rpm
 9866242fb135cca7cf3e35e97f5178af  corporate/4.0/x86_64/php-cgi-5.1.6-1.8.20060mlcs4.x86_64.rpm
 c68e05947bec3bb82e9d1d5c572f96d5  corporate/4.0/x86_64/php-cli-5.1.6-1.8.20060mlcs4.x86_64.rpm
 cf53b9aaef91d88655f9d74e3ff2aacb  corporate/4.0/x86_64/php-devel-5.1.6-1.8.20060mlcs4.x86_64.rpm
 f8c251520d975a4010def1750fd8346d  corporate/4.0/x86_64/php-fcgi-5.1.6-1.8.20060mlcs4.x86_64.rpm
 5b34f8737e26d00f33c0328d763ab213  corporate/4.0/x86_64/php-gd-5.1.6-1.3.20060mlcs4.x86_64.rpm
 758cf65ca6d0a4abebb902e0cba8a340  corporate/4.0/x86_64/php-mcrypt-5.1.6-1.1.20060mlcs4.x86_64.rpm
 13bee1adbfe5e67c01ca731ea81dbdd9  corporate/4.0/x86_64/php-soap-5.1.6-1.2.20060mlcs4.x86_64.rpm
 4c0b39d8927c6cb19e32befb0539680e  corporate/4.0/x86_64/php-zip-1.8.10-0.1.20060mlcs4.x86_64.rpm
 5ada3b423910e48a26c77a8cf95cc274  corporate/4.0/x86_64/php4-cgi-4.4.4-1.7.20060mlcs4.x86_64.rpm
 84fae5bb1c27d7c4a6dcb7c29966e2ce  corporate/4.0/x86_64/php4-cli-4.4.4-1.7.20060mlcs4.x86_64.rpm
 ccc04f5e1301a856a4d8e24bd36342cb  corporate/4.0/x86_64/php4-devel-4.4.4-1.7.20060mlcs4.x86_64.rpm
 0eafa187fc47d54782cba69a73d500f8  corporate/4.0/x86_64/php4-gd-4.4.4-1.2.20060mlcs4.x86_64.rpm
 17f6a6e9ff9cb623ba5538c46571fce5  corporate/4.0/x86_64/php4-mcrypt-4.4.4-1.1.20060mlcs4.x86_64.rpm 
 b406cd54519867c9611c6c6700827457  corporate/4.0/SRPMS/php-5.1.6-1.8.20060mlcs4.src.rpm
 491027bf3182f1f56e93e4d3a053d9e0  corporate/4.0/SRPMS/php-gd-5.1.6-1.3.20060mlcs4.src.rpm
 dd89eef4f40af9dff068c28bd56b4d5b  corporate/4.0/SRPMS/php-mcrypt-5.1.6-1.1.20060mlcs4.src.rpm
 d7107b5be0e7768abad9c15cc8584ded  corporate/4.0/SRPMS/php-soap-5.1.6-1.2.20060mlcs4.src.rpm
 f39e559d753bc59816d4106cd095d0db  corporate/4.0/SRPMS/php-zip-1.8.10-0.1.20060mlcs4.src.rpm
 1f1fd034cfd3d3f911315a34326d553e  corporate/4.0/SRPMS/php4-4.4.4-1.7.20060mlcs4.src.rpm
 00447503df74be2f96f4ec4f93de6694  corporate/4.0/SRPMS/php4-gd-4.4.4-1.2.20060mlcs4.src.rpm
 c005bcfb3c95e618ba5a4c928d5b75c7  corporate/4.0/SRPMS/php4-mcrypt-4.4.4-1.1.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 4a0e9e73f51d6118c3580b9f556c0a2d  mnf/2.0/i586/libphp_common432-4.3.4-4.27.C30mdk.i586.rpm
 f4698dd4eb9c4c9e12528c70cf458e7f  mnf/2.0/i586/php-cgi-4.3.4-4.27.C30mdk.i586.rpm
 91e6914a490349580511f216a8220c86  mnf/2.0/i586/php-cli-4.3.4-4.27.C30mdk.i586.rpm
 b5655d8d54a14d9f5cdb56246ddad2e3  mnf/2.0/i586/php-gd-4.3.4-1.7.C30mdk.i586.rpm
 752e636b31d84df4b9283fc56b60ef5b  mnf/2.0/i586/php432-devel-4.3.4-4.27.C30mdk.i586.rpm 
 dba539a2cc542b14898bea508291fb93  mnf/2.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
 86dacced331afeb19a375cdcd5ade744  mnf/2.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFG9CU6mqjQ0CJFipgRAs8RAKDsqCO/QPqLczFFlIVUz3pfMnFdUwCePmkK
vvRjTT2T2agDRpYmZWKYhFs=
=4TWc
-----END PGP SIGNATURE-----